CVE-2025-10188 is a CSRF vulnerability in The Hack Repair Guy's Plugin Archiver WordPress plugin (up to version 2.0.4). The issue arises from missing or incorrect nonce validation on the bulk_remove() function, enabling attackers to forge requests that cause directory deletions within /wp-content if an administrator is tricked into executing the action. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

Successful exploitation can lead to limited integrity and availability impact by allowing arbitrary directory deletion within the WordPress content directory. There is no confidentiality impact reported. The attack requires tricking an administrator into performing an action, so it depends on social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking suspicious links and consider disabling or removing the vulnerable plugin. Monitoring for updates from the vendor or WordPress plugin repository is recommended.